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Information Commissioner’s Office 
Call for evidence: Age Appropriate Design Code 


IAB UK submission 


(A copy of the call for evidence questions is available at https://ico.org.uk/about-the- 
ico/ico-and-stakeholder-consultations/call-for-evidence-age-appropriate-design-code/) 


Q2. Please provide any views or evidence you have on children’s development needs, in an 

online context in each or any of the above age brackets. 
In the context of advertising regulation, the Committee of Advertising Practice (CAP) 
undertook some work exploring children’s recognition and understanding of online 
advertising, resulting in publication of its guidance Recognition of advertising: online 
marketing to children under 12 in April 2017. As part of this work, CAP reviewed the 
evidence on children’s critical understanding capabilities at different ages. This 
indicated that children had three distinct stages of cognitive development: 0-7; 8-11; 
12-15. The guidance was subsequently developed to address issues arising with the 
first two age groups, i.e. those under 12. The ICO’s proposed age brackets do not 
align with those identified by CAP, and it is unclear from the call for evidence on 
what basis they have been selected. It would be useful if age categories used for 
similar purposes could be aligned, as far as possible. 


Aspects of design 


Q4. Please provide any views or evidence you think the Commissioner should take into 
account when explaining the meaning and coverage of these terms in the code. 


e automated and semi-automated profiling 
e transparency of paid-for activity such as product placement and marketing 
e the sharing and resale of data 


The ICO should consult with relevant industries, including the advertising industry, to 
ensure that any definitions it develops accurately reflect how data is used in 
practice, e.g. for ‘profiling’, and make a clear distinction between terms whose 
meanings can differ depending on the context and the ultimate purpose of the data 
use. 


Any definitions of marketing should take into account existing definitions used in 
legislation and in the UK advertising industry self-regulatory Code of Advertising 
Practice (CAP Code) for non-broadcast advertising. The ICO’s Code should 
complement but not duplicate what is already within the remit of the CAP Code and 
the advertising regulator, the Advertising Standards Authority (ASA). 
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Q5. Please provide any views or evidence you have on the following: 


Q5D. examples of ISS design you consider to be good practice. 


In addition to legislative requirements and the mandatory self-regulatory system of 
CAP and the ASA, the digital advertising industry has established self-regulatory 
frameworks in other specific areas in order to set out accepted standards and good 
practice for responsible advertising. One such framework covers the use of personal 
data for online behavioural advertising. 


IAB UK acknowledges that the collection and use of consumer data could potentially 
raise issues relating to consumer privacy. In 2011, building on an US initiative and 
the development of good practice in the UK, EU advertising and media trade bodies 
published good practice for all EU and EEA markets to enhance transparency and 
user control for online behavioural advertising (OBA): the EDAA AdChoices 
Programme. This framework applies to advertising targeted at any user, including 
those aged under 18, and requires participating businesses to agree not to create 
‘interest segments’ to specifically target children (12 and under). 


The initiative is based upon seven key principles, one of which is: 


iv. Sensitive segmentation: This principle recognises the need for additional 
protection for younger children, and requires participating businesses to 
agree not to create ‘interest segments’ to specifically target children (12 and 
under) and on the collection and use of sensitive personal data for 
behavioural advertising. 


A copy of the EU industry Framework and the full set of principles can be found at: 
http://edaa.eu/european-principles/. At the heart of this work is a symbol or icon 
(see right — often known as the ‘AdChoices’ icon) that appears in or 

around the advertisements on sites, as well as on site pages 

themselves. 


When a user clicks on the icon he or she will be able to find out more about the 
information collected and used for this purpose. In 2017, over 170bn icons were 
delivered by approved providers across Europe, giving consumers significant 
opportunities to manage or control their online advertising preferences. 


The icon also links to ways for internet users to manage their interests, such as via 
privacy dashboards or ad preference managers. It also links to a pan-European 
website — www.youronlinechoices.eu — with helpful advice, tips to help protect 
privacy and a control page where you can turn off behavioural advertising. There are 
on average 1.9 million unique visitors to www.youronlinechoices.eu every month.” 


1 https://www.edaa.eu/ext/edaa_2017.html 


2 ibid. 
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The UK version of the website is at www.youronlinechoices.eu/uk. Further 
information on the initiative is available at https://www.iabuk.com/policy/iab- 
factsheet-may-2014-online-behavioural-advertising. 


The EU industry initiative is administered by the European Interactive Digital 
Advertising Alliance (EDAA) www.edaa.eu. The ASA administers OBA consumer 
complaints in the UK and in 2013 new rules on OBA were introduced to the CAP 
Code to ensure businesses provide: 


notice to be provided to web users in or around the advertisement; 
choice via an opt out mechanism to prevent data from being collected and used for 
behavioural ad purposes. ê 


These rules are complementary to the EDAA’s OBA Framework: those businesses 
complying with the Framework will be complying with the CAP Code. 


It should be noted that a number of the aspects covered by the Framework (such as 
notice, choice, and sensitive segmentation) are now covered by the GDPR and we 
expect that the Framework will evolve in light of that. 


Another example of existing industry good practice is the UKCISS Child Safety Online 
guide for providers of social media and interactive services. The guide is not specific 
to advertising, but includes advertising in its scope, including in relation to data use. 
Section 5 of the guide addresses Privacy and there is specific guidance in Section 3 in 
relation to children under 13. This could be a useful starting point for the ICO’s Code. 


CAP’s guidance on recognition of advertising and children under 12, referred to in 
our response to question 2, sets out how advertisers can help to ensure that online 
advertising is ‘obviously identifiable’ to children, particularly where the nature of an 
ad means that it is likely to need enhanced disclosure to make sure that children can 
recognise it as an ad. This guidance does not cover ISS design, but rather what is 
expected of marketers (who have primary responsibility for compliance under the 
CAP Code) when it comes to transparency and younger children, and should be 
taken into account by the ICO in developing any aspects of its Code that may cover 
advertising and transparency. 


Q6. If you would be interested in contributing to future solutions focussed work in 
developing the content of the code please provide the following information. The 
Commissioner is particularly interested in hearing from bodies representing the views of 


3 In response to changes introduced by the GDPR, the Committee of Advertising Practice (CAP) is consulting on 
changes to the rules related to the collection and use of data for marketing. 
https://www.asa.org.uk/news/gdpr-consultation-on-the-collection-and-use-of-data-for-marketing.html 
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children or parents, child development experts and trade associations representing 
providers of online services likely to be accessed by children, in this respect. 


The IAB is happy to work with the ICO on an areas of the code that may relate to 
digital advertising, including providing information and helping to develop solutions. 
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